Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How the Zoom macOS installer does its job without you clicking ‘install’

twitter.com

Post reply on HN
Print view View original

311–320 of 334 posts

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#311

Post by jwr »

gentleman11 wrote: post #204
jwr wrote: post #184

Earlier quoted context omitted.

> I'm still curious why everyone thinks Zoom "just works" while others don't. I'm also curious. I subscribed to Whereby ( https://whereby.com/ ), where I can send people a URL, which they click and land in my conference room. There is ZERO software they need to install. [For all the "well, actually" folks: yes, it "only" works in every modern browser out there, and it works "only" for up to 12 people. Fine with me.]…

To be more specific, whereby seems to be free for up to 4 people, but then they claim to be able to support 50. Never tested it with 50

Specifically, my "Pro" plan allows up to 12 people.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#312

Post by fouc »

microtonal wrote: post #27
Wowfunhappy wrote: post #14

Earlier quoted context omitted.

Note that in this case, it's still a legit OS dialog. Preflight scripts are very much built into the macOS pkg format, they're just not intended to be used like this.

I never understood why Apple still supports the pkg format. It seems a half-baked leftover from the 2000s and even then I was already surprised that there is no way to uninstall things through the macOS GUI. I am not sure if this has changed (I try to avoid pkg files and use Homebrew cask to uninstall such packages), but IIRC you had to list the files with pkgutil on the command-line, remove stuff by hand and then --…

pkg is there explicitly to let companies install sketchy shit. Any application that relies on pkg to be installed is fundamentally risky.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#313

Post by latexr »

mrzool wrote: post #243
elevenoh wrote: post #236

Earlier quoted context omitted.

Best zoom alternative?

We just started using Whereby and we’re loving it. I strongly recommended against Zoom.

I recommend against Whereby.

I was a big proponent when they started as appear.in, but they’ve been steadily removing features (or moving them to the paid plan). For my friend group, the biggest appeal was that you could use it in a browser without an account by inventing a room name. That was one of the first features to get cut.

Everyone I’ve ever recommended it to has bumped into the limitations, asked me “what happened”, and switched to something else.

I haven’t tried it extensively, but I’ve read about https://meet.jit.si/ on HN and passed it on to a friend in that situation. He was happy with it and described it as “what appear.in used to be”.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#314

Post by latexr »

microtonal wrote: post #27
Wowfunhappy wrote: post #14

Earlier quoted context omitted.

Note that in this case, it's still a legit OS dialog. Preflight scripts are very much built into the macOS pkg format, they're just not intended to be used like this.

I never understood why Apple still supports the pkg format. It seems a half-baked leftover from the 2000s and even then I was already surprised that there is no way to uninstall things through the macOS GUI. I am not sure if this has changed (I try to avoid pkg files and use Homebrew cask to uninstall such packages), but IIRC you had to list the files with pkgutil on the command-line, remove stuff by hand and then --…

If the pkg format was no longer supported, developers might use GUI installers instead, and those are harder to verify and install/uninstall programmatically.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#315

Post by danlugo92 »

jwr wrote: post #184
t0mas88 wrote: post #10

Earlier quoted context omitted.

I'm still curious why everyone thinks Zoom "just works" while others don't. Because in an enterprise context it is often hard to download an executable and run it with sufficient permissions. While Google and Microsoft both offer a product that "just works" with only a browser. What makes Zoom more "just works" than that?

> I'm still curious why everyone thinks Zoom "just works" while others don't. I'm also curious. I subscribed to Whereby ( https://whereby.com/ ), where I can send people a URL, which they click and land in my conference room. There is ZERO software they need to install. [For all the "well, actually" folks: yes, it "only" works in every modern browser out there, and it works "only" for up to 12 people. Fine with me.]…

I use whereby too. It's great.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#316

Post by sneak »

8fingerlouie wrote: post #307
sneak wrote: post #282

Earlier quoted context omitted.

Presumably if you don't like Zoom's shadiness, you may not like Homebrew's bundled spyware either. Disable it with brew analytics off

Isn't that more like Debian popularity contest ? https://popcon.debian.org/

No. Homebrew sends a per-installation unique identifier to a third party (Google), tracking your location across different IPs, whether you want it to or not.

Popcon is first-party, and is entirely opt-in. It doesn’t send anything unless you want it to.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#317

Post by danans »

saagarjha wrote: post #244
danans wrote: post #117

For those calling this a security vulnerability in MacOS, isn't this just using a GUI equivalent of "sudo"? There may be a decent argument that a consumer OS shouldn't offer such a sudo-like API to installers, but MacOS probably does this for legacy app support reasons. IMO the better question in this case is why Zoom needs to be installed as admin on MacOS? After all, the mobile apps and chrome extension don't need…

This is like the GUI equivalent of running "apt install zoom" and the installation script killing the APT process and then running amok with its root privileges.

> This is like the GUI equivalent of running "apt install zoom" and the installation script killing the APT process and then running amok with its root privileges.

So in that case it seems like there is perhaps an issue on both sides.

- I understand that the OS API to get root/admin privileges likely exists for legacy app install reasons, but why should any install script even be able to run amok with admin privileges? Shouldn't privileges granted by this API this is using be sandboxed in the extreme? Something this sensitive shouldn't be left to the honor system of the app developer.

- Independently, I still don't understand why Zoom needs admin privs on Mac when it clearly doesn't need them when installed as a browser extension. I'm using it just fine in Chrome all the time - no admin rights needed.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#318

Post by notriddle »

eyegor wrote: post #277

Can someone explain to me what the problem is? If you run the installer, isn't that consent to install the software? That's the whole point of it. I guess this isn't the "Mac way" but this is exactly how I would write an install script if I was slapping together support for other platforms. In fact this is the same way most installers work: it unzips an archive somewhere, then creates the links for remove/launch/etc.…

Zoom is using a hook in the macOS installer framework in a way that is not intended.

This is forming a troubling pattern [1]. Zoom will do anything to reduce the number of clicks to start a conference, even if results in a misleading installer prompt or security vulnerability.

[1]: https://www.zdnet.com/article/zoom-defends-use-of-local-web-...

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#319

Post by Aachen »

lultimouomo wrote: post #305
Aachen wrote: post #254

Earlier quoted context omitted.

One could say the same for gksudo, UAC prompts, or the equivalent dialog on your favorite operating system, no? Or is there something on other OSes that identifies it?

I don't think UAC is spoofable - if I remember well it minimizes all the other windows and hides the taskbar, which you shouldn't be able to do with a regular dialog. gksudo is definitely spoofable, except I almost never get a gksudo dialog. I am not trained to expect every other app to periodically ask me for my password.

Any application can draw over the task bar as far as I know? Seems weird if games needed root permissions just to be full screen.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#320

Post by mr_toad »

miguelmota wrote: post #212

What I like about zoom is that I can click on a zoom link and it opens up my video conference pretty quickly. Last thing I want is to go through installation steps when people are waiting for me on a call. I understand the security implications but it's a trade-off between user experience and lesser security.

People will go through the hassle of booking airline tickets, hotels, taxis and take the time to travel to face to face meetings (and some of them even seem to enjoy it).

But they won’t spend 5 minutes installing software properly, or half an hour doing some legwork.

Post reply on HN